)]}'
{
  "commit": "3ca1929bfcf693c0285a58d940e45bd1b403b18e",
  "tree": "0e93e80e284d9e90afdf27d95bef7c76918c6ef8",
  "parents": [
    "218dbd86823505f90d29d03291fa4cc19bedfdb2"
  ],
  "author": {
    "name": "Pablo Neira Ayuso",
    "email": "pablo@netfilter.org",
    "time": "Sun Jul 23 16:24:46 2023 +0200"
  },
  "committer": {
    "name": "Michael Kochera",
    "email": "kochera@google.com",
    "time": "Sun Sep 17 10:56:57 2023 +0000"
  },
  "message": "netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR\n\n[ Upstream commit 0a771f7b266b02d262900c75f1e175c7fe76fec2 ]\n\nOn error when building the rule, the immediate expression unbinds the\nchain, hence objects can be deactivated by the transaction records.\n\nOtherwise, it is possible to trigger the following warning:\n\n WARNING: CPU: 3 PID: 915 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]\n CPU: 3 PID: 915 Comm: chain-bind-err- Not tainted 6.1.39 #1\n RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]\n\nBUG\u003db/300063359\nTEST\u003dNone\nRELEASE_NOTE\u003dFixed CVE-2023-4015 in the linux kernel.\n\ncos-patch: security-high\nFixes: 4bedf9eee016 (\"netfilter: nf_tables: fix chain binding transaction logic\")\nReported-by: Kevin Rich \u003ckevinrich1337@gmail.com\u003e\nChange-Id: I545f1724b7a66b85ca5ceaa63f714f6b13568459\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/57312\nReviewed-by: Oleksandr Tymoshenko \u003covt@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "6b0efab4fad09fd53210b41f4cc7fe64c876065f",
      "old_mode": 33188,
      "old_path": "net/netfilter/nft_immediate.c",
      "new_id": "6bf1c852e8eaa0191591323f9d9da168a9b5ef20",
      "new_mode": 33188,
      "new_path": "net/netfilter/nft_immediate.c"
    }
  ]
}